Managing electronic health records within a wide area care provider domain

• US 20070078687A1
• Filed: 09/30/2005
• Published: 04/05/2007
• Est. Priority Date: 09/30/2005
• Status: Abandoned Application

• Current Assignee: International Business Machines Corporation
• Original Assignee: International Business Machines Corporation
• Inventors: Dettinger, Richard, Stevens, Richard, Kolz, Daniel
• Application Number:
  US11/241,707
• Publication Number:
  US 20070078687A1
• Time in Patent Office: Days
• US Class Current: 705/3
• CPC Class Codes: G06Q 10/10 Office automation; Time management
• CPC Class Codes: G06Q 20/40 Authorisation, e.g. identification of payer or payee, verification of customer or shop credentials; Review and approval of payers, e.g. check credit lines or negative lists
• CPC Class Codes: G16H 10/60 for patient-specific data, e.g. for electronic patient records

Abstract

Embodiments of the invention provide an individual with control over who may access an account of electronic health records (EHR records) related to the individual. The health records may be stored a network-accessible storage repository. An entity providing healthcare related goods or services may request access to an account by transmitting a request over a data communications network. Access is granted or denied depending on whether the individual has authorized access to the account. Two common transactions include deposit transactions to add records to the account, and withdrawal transactions to retrieve and view records from the account.

Claims

1. A computer-implemented method for providing controlled access to electronic health records, comprising:

providing a network-accessible storage repository configured to store a plurality of electronic health records regarding a plurality of individuals;

each of the plurality of individuals having an electronic health records account (EHR account) that identifies which electronic health records in the network-accessible storage repository are associated With the individual;

receiving, over a data communications network, a request to access one of the plurality of EHR accounts;

determining whether the individual associated with the EHR account referenced by the request has authorized the request; and

if the individual has authorized the request, granting access to the EHR account.

2. The method of claim 1, further comprising, providing each individual with an account instrument, wherein the account instrument specifies at least an account identifier and routing information specifying the network location of the network-accessible storage repository.

3. The method of claim 2, wherein the individual authorizes the request by providing the account instrument to an entity providing the individual with healthcare related goods or services.

4. The method of claim 2, wherein the individual authorizes the request by providing the account instrument and an account access code to an entity providing the individual with healthcare related goods or services.

5. The method of claim 2, wherein the account instrument comprises a token device with an embedded electronic device that is used to encode the account identifier and the routing information for the account.

6. The method of claim 1, wherein the request is to perform a deposit transaction to deposit an electronic health record included with the request into the EHR account.

7. The method of claim 6, wherein performing the deposit transaction comprises:

storing the electronic health record included with the request in the network-accessible storage repository; and

recording an indication of an entity that submitted the request over the data communications network.

8. The method of claim 6, wherein the entity that submitted the request is the individual, and wherein the electronic health record to be deposited comprises observations recorded by the individual.

9. The method of claim 1, wherein determining whether the individual associated with the EHR account referenced by the request has authorized the request comprises validating a digital signature attached to the request generated using a cryptographic key associated with the individual.

10. The method of claim 9, wherein determining whether the individual associated with the EHR account referenced by the request has authorized the request further comprises validating a digital signature attached to the request generated using a cryptographic key associated with an entity transmitting the request.

11. The method of claim 1, wherein the request is to perform a withdrawal transaction, requesting to withdraw at least one of the plurality of electronic health records in the network-accessible storage repository.

12. The method of claim 11, wherein the request further includes an indication of the entity submitting the withdrawal request.

13. The method of claim 11, wherein performing the withdrawal transaction comprises:

retrieving the at least one of the plurality of electronic health records from the storage repository;

returning the at least one of the plurality of electronic health records to an entity that transmitted the request; and

recording an indication of an entity that submitted the request over the data communications network in the network-accessible storage repository.

14. The method of claim 11, wherein the entity submitting the withdrawal request is the individual associated with the EHR account, and wherein the at least one of the plurality of electronic health records is returned, over the data communications network, to the individual.

15. The method of claim 11, wherein the at least one of the plurality of electronic health records is returned in an encrypted format, and wherein a cryptographic key provided by the individual may be used to decrypt the at least one of the plurality of electronic health records.

16. The method of claim 1, further comprising, validating the request using a validation service provided by an insurance claims processor.

17. A computer-readable storage medium including a program, which when executed on a processor performs a method for providing controlled access to electronic health records, comprising:

providing a network-accessible storage repository configured to store a plurality of electronic health records regarding a plurality of individuals;

each of the plurality of individuals having an electronic health records account (EHR account) that identifies which electronic health records in the network-accessible storage repository are associated with the individual;

receiving, over a data communications network, a request to access one of the plurality of EHR accounts;

determining whether the individual associated with the EHR account referenced by the request has authorized the request; and

if the individual has authorized the request, granting access to the EHR account.

18. The computer-readable medium of claim 17, further comprising, providing each individual with an account instrument, wherein the account instrument specifies at least an account identifier for the EHR account and routing information specifying the network location of the network-accessible storage repository.

19. The computer-readable storage medium of claim 18, wherein the individual authorizes the request by providing the account instrument to an entity providing the individual with healthcare related goods or services.

20. The computer-readable storage medium of claim 18, wherein the account instrument comprises a token device with an embedded electronic device that is used to encode the account identifier and the routing information for the account.

21. The computer-readable storage medium of claim 18, wherein the individual authorizes the request by providing the account instrument and an account access code to an entity providing the individual with healthcare related goods or services.

22. The computer-readable storage medium of claim 17, wherein the request is to perform a deposit transaction to deposit an electronic health record included with the request into the EHR account.

23. The computer-readable storage medium of claim 22, wherein performing the deposit transaction comprises:

storing the electronic health record included with the request in the network-accessible storage repository; and

recording an indication of an entity that submitted the request over the data communications network.

24. The computer-readable storage medium of claim 22, wherein the entity that submitted the request is the individual, and wherein the electronic health record to be deposited comprises observations recorded by the individual.

25. The computer-readable storage medium of claim 17, wherein determining whether the individual associated with the EHR account referenced by the request has authorized the request comprises validating a digital signature attached to the request generated using a cryptographic key associated with the individual.

26. The computer-readable storage medium of claim 25, wherein determining whether the individual associated with the EHR account referenced by the request has authorized the request further comprises validating a digital signature attached to the request generated using a cryptographic key associated with an entity transmitting the request.

27. The computer-readable storage medium of claim 17, wherein the request is to perform a withdrawal transaction, requesting to withdraw at least one of the plurality of electronic health records in the network-accessible storage repository.

28. The computer-readable storage medium of claim 27, wherein the request further includes an indication of the entity submitting the withdrawal request.

29. The computer-readable storage medium of claim 27, wherein performing the withdrawal transaction comprises:

retrieving the at least one of the plurality of electronic health records from the storage repository;

returning the at least one of the plurality of electronic health records to an entity that transmitted the request; and

recording an indication of an entity that submitted the request over the data communications network in the network-accessible storage repository.

30. The computer-readable storage medium of claim 27, wherein the entity submitting the withdrawal request is the individual associated with the EHR account, and wherein the at least one of the plurality of electronic health records is returned, over the data communications network, to the individual.

31. The computer-readable storage medium of claim 27, wherein the at least one of the plurality of electronic health records is returned in an encrypted format, and wherein a cryptographic key provided by the individual may be used to decrypt the at least one of the plurality of electronic health records.

32. The computer-readable storage medium of claim 17, further comprising, validating the request using a validation service provided by an insurance claims processor.

33. A system for providing controlled access to electronic health records, comprising:

a network-accessible storage repository configured to store a plurality of electronic health records regarding a plurality of individuals;

a plurality of electronic health records accounts (EHR accounts) provided to the plurality of individuals, wherein each EHR account identifies which electronic health records are associated with a particular individual;

a computer with a memory containing a program configured to receive, over a data communications network, a request to access one of the plurality of EHR accounts;

and in response, to determine whether the individual corresponding to the EHR account specified by the request has authorized the request; and

if the individual has authorized the request, to grant access to the EHR account, and performing a transaction specified by the request.